585c912dff9d1dd306f86518c702171691eb50dea7650f0b68dee5cd4ce75651

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Aug-04 05:03:34
Detected languages English - United States
Debug artifacts C:\dev\dump\Simple-Manual-Map-Injector\x64\Release\Injector-x64.pdb

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • %temp%
  • CurrentControlSet\Services
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • exploit
 Contains domain names:
  • 2010-aia.verisign.com
  • 2010-crl.verisign.com
  • aia.verisign.com
  • aia.ws.symantec.com
  • crl.microsoft.com
  • crl.thawte.com
  • crl.verisign.com
  • crl.ws.symantec.com
  • csc3-2010-aia.verisign.com
  • csc3-2010-crl.verisign.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
  • http://crl.thawte.com
  • http://crl.thawte.com/ThawteTimestampingCA.crl0
  • http://crl.verisign.com
  • http://crl.verisign.com/pca3-g5.crl04
  • http://csc3-2010-aia.verisign.com
  • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
  • http://csc3-2010-crl.verisign.com
  • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
  • http://logo.verisign.com
  • http://logo.verisign.com/vslogo.gif04
  • http://ocsp.thawte.com0
  • http://ocsp.verisign.com0
  • http://ts-aia.ws.symantec.com
  • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
  • http://ts-crl.ws.symantec.com
  • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
  • http://ts-ocsp.ws.symantec.com07
  • https://www.verisign.com
  • https://www.verisign.com/cps0
  • https://www.verisign.com/rpa
  • https://www.verisign.com/rpa0
  • logo.verisign.com
  • microsoft.com
  • symantec.com
  • thawte.com
  • ts-aia.ws.symantec.com
  • ts-crl.ws.symantec.com
  • verisign.com
  • ws.symantec.com
  • www.verisign.com
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to AES
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • NtQuerySystemInformation
 Can access the registry:
  • RegCloseKey
  • RegCreateKeyW
  • RegOpenKeyW
  • RegSetKeyValueW
 Possibly launches other programs:
  • system
 Uses Windows's Native API:
  • NtQuerySystemInformation
  • NtUnloadDriver
  • NtLoadDriver
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Manipulates other processes:
  • Process32NextW
  • Process32FirstW
Malicious VirusTotal score: 29/71 (Scanned on 2026-08-04 14:49:22) ALYac: Gen:Variant.Yogi.36862
APEX: Malicious
AVG: FileRepMalware [Misc]
Arcabit: Trojan.Yogi.D8FFE
Avast: FileRepMalware [Misc]
BitDefender: Gen:Variant.Yogi.36862
Bkav: W32.Malware.9C458745
CTX: exe.unknown.yogi
ClamAV: Win.Tool.Zusy-10033075-0
CrowdStrike: win/malicious_confidence_60% (D)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
DrWeb: Tool.VulnDriver.22
ESET-NOD32: Win64/HackTool.GameHack.Q trojan
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Yogi.36862 (B)
GData: Gen:Variant.Yogi.36862
Ikarus: Trojan.Win64.Krypt
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: ti!585C912DFF9D
MicroWorld-eScan: Gen:Variant.Yogi.36862
Microsoft: Trojan:Win64/DriverLoader.RDB!MTB
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Symantec: ML.Attribute.HighConfidence
Trapmine: suspicious.low.ml.score
VIPRE: Gen:Variant.Yogi.36862
huorong: Exploit/Vulndriver.c!crit

Hashes

MD5 9ac18a98af590524f42f81eb8a47cb45
SHA1 47aa4a0893f5e025ded945ebe0de5c4169e79d7a
SHA256 585c912dff9d1dd306f86518c702171691eb50dea7650f0b68dee5cd4ce75651
SHA3 21cf39fcc2d5d6a3bbab3c63a3b999f05c4070e2d91e530933e5a756550afd34
SSDeep 196608:doVcSZ1fMHicWyrgG5KBCxO0uGCG1S8wcX+sPc5+Hy6EAoXS:dXSZklwBCUPGjSxcX+sPc5+HJEfX
Imports Hash 7102de10c5e1996df57ae3383a4519b8

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Aug-04 05:03:34
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x11e00
SizeOfInitializedData 0x784a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000011B24 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x79a000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 046f915c0e4a3033542287e866270015
SHA1 5c24e1ca50c4dd3e1cb454ac2ce2afb4e5fc5568
SHA256 0267be9229eabfb8717d41b7282bf95c15a3be4e937956aac9a31ae4c01d46c5
SHA3 358de287005a638be123e663c3aced6413e456e3c416d593929d69258bcc6416
VirtualSize 0x11c83
VirtualAddress 0x1000
SizeOfRawData 0x11e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.23754

.rdata

MD5 07debe5090933b7def2a72b68dbfbd4d
SHA1 9154e6da3f6a5def620caaad8d6eb425363614ac
SHA256 19de0ce7448ad809fe28a7a7f7c620ce3b83ef6740b9855a93bd7270b8a5a788
SHA3 51ee0e9b4a5b693d2077584e9ca7f17f300e9196472230371acb841937de28d6
VirtualSize 0x13b7e
VirtualAddress 0x13000
SizeOfRawData 0x13c00
PointerToRawData 0x12200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.98369

.data

MD5 6c7aaced01321c74e31b592994ffcdc5
SHA1 5fcd51922be1ba382eb7edec6fb7c994d85c7113
SHA256 a4ec05d5016af729ee75fb236194da96d632e253f3a03b20127e9e98091b796b
SHA3 42af5de1ec504865504660db256fbd644ad7de72a0be0d5ad225d19c347419cf
VirtualSize 0x76fcb0
VirtualAddress 0x27000
SizeOfRawData 0x76f600
PointerToRawData 0x25e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99876

.pdata

MD5 d82dc0f3a70420979535bd8bbd94411f
SHA1 f5758db629f5240129415de2138aaf66859e4090
SHA256 a1472568052f2ad05e10548661e1f28178689afe7940a69914133bfc714dbb43
SHA3 8355b74ce89d678c8a691b19a7bec8ff17f57bad0edb022bdeb2ddc8b5bd2b81
VirtualSize 0xbac
VirtualAddress 0x797000
SizeOfRawData 0xc00
PointerToRawData 0x795400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.05313

.rsrc

MD5 a2245fa5747ee94df0683bdc48bb576b
SHA1 c50a0ddfc1197691f892ced03f9fe38df6b51f3a
SHA256 1f66f5ab19c974d42a8331a2966f15716e7f6e24d318c80de395f9cd98d75eac
SHA3 cf9fce7e92d9b81909f1074345e7a880c50e010c1fbde2a4b4e2dd6892ea55a3
VirtualSize 0x1e8
VirtualAddress 0x798000
SizeOfRawData 0x200
PointerToRawData 0x796000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.75904

.reloc

MD5 7834090672126fe972c2457f28bc9b73
SHA1 cebf241a88ff497768d2aa845894e4b5c049d704
SHA256 749a257d13d547271558d9f56143c3dfeed66c989e5f0127b453fddd42ad501e
SHA3 7aa916fc5f57f131dd80e96c4a29082b89b49d40c6fe3a276780b3eea54caf36
VirtualSize 0xc8
VirtualAddress 0x799000
SizeOfRawData 0x200
PointerToRawData 0x796200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.47421

Imports

KERNEL32.dll CloseHandle
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
RtlAddFunctionTable
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetLastError
Process32NextW
Process32FirstW
VirtualFree
VirtualAlloc
GetCurrentThreadId
GetModuleHandleA
GetTempPathW
AcquireSRWLockExclusive
GetTickCount64
Sleep
CreateFileW
DeviceIoControl
CreateToolhelp32Snapshot
QueryDosDeviceW
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
ReleaseSRWLockExclusive
ADVAPI32.dll RegCloseKey
RegDeleteTreeW
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW
MSVCP140.dll ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?id@?$ctype@_W@std@@2V0locale@2@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
bcrypt.dll BCryptHashData
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptCreateHash
BCryptSetProperty
BCryptDestroyHash
BCryptEncrypt
ntdll.dll NtQuerySystemInformation
NtUnloadDriver
RtlAdjustPrivilege
NtLoadDriver
RtlInitUnicodeString
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memmove
__std_exception_destroy
__std_exception_copy
__std_terminate
wcsstr
memcmp
memcpy
memset
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
api-ms-win-crt-stdio-l1-1-0.dll _fseeki64
fread
fsetpos
ungetc
__stdio_common_vfprintf
fputc
setvbuf
_set_fmode
fgetpos
fwrite
fgetc
_get_stream_buffer_pointers
fclose
fflush
__p__commode
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0.dll _invoke_watson
_c_exit
_register_thread_local_exe_atexit_callback
__p___wargv
terminate
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
system
__p___argc
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
api-ms-win-crt-heap-l1-1-0.dll malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-string-l1-1-0.dll _stricmp
_wcsicmp
api-ms-win-crt-utility-l1-1-0.dll rand
srand
api-ms-win-crt-filesystem-l1-1-0.dll _lock_file
_unlock_file
_wremove
api-ms-win-crt-time-l1-1-0.dll _time64
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Aug-04 05:03:34
Version 0.0
SizeofData 92
AddressOfRawData 0x23194
PointerToRawData 0x22394
Referenced File C:\dev\dump\Simple-Manual-Map-Injector\x64\Release\Injector-x64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Aug-04 05:03:34
Version 0.0
SizeofData 20
AddressOfRawData 0x231f0
PointerToRawData 0x223f0

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-04 05:03:34
Version 0.0
SizeofData 912
AddressOfRawData 0x23204
PointerToRawData 0x22404

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Aug-04 05:03:34
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1400235b8
EndAddressOfRawData 0x1400235c0
AddressOfIndex 0x140796604
AddressOfCallbacks 0x140013680
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140027040

RICH Header

XOR Key 0xe769da18
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 18
ASM objects (35207) 4
C objects (35207) 10
C++ objects (35207) 33
Imports (35207) 6
Imports (35215) 9
Total imports 218
C++ objects (LTCG) (35225) 9
Resource objects (35225) 1
Linker (35225) 1

Errors

Leave a comment

No comments yet.